Security check

What your browser tells any website, measured here in your browser. Each row names the API it came from, so you can check it.

Your browser's name, version and operating system, read from navigator.userAgentData on Chromium and from the user-agent string elsewhere.

Whether your browser predates the fix for CVE-2023-4863, the libwebp heap overflow exploited in 2023. Fixed in Chrome 116.0.5845.187, Firefox 117.0.1, Firefox ESR 115.2.1, iOS 16.6.1 and macOS 13.5.2. A version check only, no exploit code.

How coarse your browser keeps its clock, measured from performance.now(), and whether SharedArrayBuffer is on. Coarse timers and no shared memory are the Spectre mitigations.

Screen size, pixel ratio, CPU threads, memory, touch points and graphics card, as any script can read them.

A hash of a drawn canvas, a test for whether your browser adds noise to canvas reads, and a short SHA-256 of everything on these pages.

TLS version, cipher, HTTP version and the IP address this server saw, echoed back by /whoami. JavaScript can't see these on its own.

The security headers this site sends: HSTS, Content-Security-Policy, Referrer-Policy, Permissions-Policy, COOP and nosniff.

Global Privacy Control, Do Not Track, cookie support, a content blocker test with a bait element, and whether this device could use a passkey.

Your local IP as WebRTC exposes it (host candidates only, no STUN request), and the rough location your time zone and languages give away without a prompt.